Multiparty quantum secret sharing based on Bell measurement

Multiparty quantum secret sharing based on Bell measurement

Optics Communications 282 (2009) 3647–3651 Contents lists available at ScienceDirect Optics Communications journal homepage: www.elsevier.com/locate...

173KB Sizes 1 Downloads 129 Views

Optics Communications 282 (2009) 3647–3651

Contents lists available at ScienceDirect

Optics Communications journal homepage: www.elsevier.com/locate/optcom

Multiparty quantum secret sharing based on Bell measurement Ying Sun a,b,*, Qiao-yan Wen a, Fei Gao a, Xiu-bo Chen a, Fu-chen Zhu c a b c

State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing 100876, China State Key Laboratory of Integrated Services Network, Xidian University, Xi’an 710071, China National Laboratory for Modern Communications, P.O. Box 810, Chengdu 610041, China

a r t i c l e

i n f o

Article history: Received 10 March 2009 Received in revised form 6 May 2009 Accepted 15 May 2009

PACS: 03.67.HK 03.65.Ud 03.67.Dd

a b s t r a c t A multiparty quantum secret sharing scheme based on Bell measurement is proposed and analyzed. In this scheme, all agents are not required to prepare entangled states or perform any local unitary operation. The security of the protocol is also analyzed. It is shown that any eavesdropper will introduce errors invariably and be detected if he tries to steal information about Trent’s secret. Moreover, because no classical bit needs to be transmitted except those for detection, the total efficiency of the scheme approaches to 100%. Ó 2009 Elsevier B.V. All rights reserved.

Keywords: Bell measurement Entanglement swapping Quantum secret sharing Quantum cryptography

1. Introduction Secret sharing is one of the useful tools in the cryptographic applications. Suppose Trent wants his two agents, Alice and Bob, who are at remote places to deal with his business. However, Trent doubts that one of them may be dishonest. He does not know who the dishonest one is, but he knows that the number of dishonest persons is less than two. To prevent the dishonest man from destroying the business, classical cryptography provides the secret sharing scheme in which Trent splits his secret message ðMT Þ into two sequences (M A and MB ) and sends them to Alice and Bob, respectively. Alice and Bob can read out the message M T ¼ MA  M B if and only if they cooperate. In quantum information, the task can be completed by quantum secret sharing (QSS). The first QSS scheme proposed by Hillery, Buzˇek, and Berthiaume used threeparticle entangled Greenberger–Horne–Zeilinger (GHZ) states [1]. Since the publication of this pioneering work, several variations and theoretical expansions of QSS have been reported [2–14]. Indeed, subsequent developments have shown that both classical

* Corresponding author. Address: State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing 100876, China. E-mail address: [email protected] (Y. Sun). 0030-4018/$ - see front matter Ó 2009 Elsevier B.V. All rights reserved. doi:10.1016/j.optcom.2009.05.054

information and quantum information can be shared with quantum mechanics. In this paper, we only consider the issue of sharing the classical secret information. Quantum mechanics also provides different tools to achieve QSS, such as the impossibility of cloning unknown non-orthogonal quantum states and entanglement among particles. Recently, entanglement swapping [15], which is a method that enables one to entangle two quantum systems that have never direct interacted before, has also been used to solve the problem of QSS [11,16–21]. However, in those QSS of classical information protocols based on entanglement swapping [11,16–18,21], there are some additional restrictions that lead to either higher technology requirement or lower efficiency. For example, the agents need have the ability to prepare entangled states [16,17], or some participants have to perform local unitary operations or apply quantum Fourier transform [11,17,18,21]. In this paper, we proposed a novel multiparty QSS scheme based on entanglement swapping, which entangles two particles belonging to the different N-particle GHZ states by appropriately projecting the other particles pairwise entangled. In our scheme, the agents need not prepare any quantum state or carry out local unitary operations. When generating keys, all agents only need to perform Bell measurement [26,27] no matter how many participants there are in the QSS task. No classical information is required to be transmitted during the protocol except for the

3648

Y. Sun et al. / Optics Communications 282 (2009) 3647–3651

detection process. Furthermore, all instances are transmitted through the quantum channel only once which means fewer particles is wasted in the channel noise. In other words, we can obtain an optimal efficiency in our QSS scheme. The paper is outlined as follows: First, we give the details of the multiparty QSS scheme based on Bell measurement. Then we discuss the security of the scheme against eavesdropping. At last, we give a conclusion about the character and the application of the scheme.

2. Multiparty QSS scheme based on Bell measurement Before describing our scheme, we should give a brief review about four Bell states and state the theory of our scheme by showing the relationship of the agents’ measurement results in the three-party case. Four Bell states and two GHZ states used in the three-party case of our scheme are defined as follows.

1 j/þ i ¼ pffiffiffi ðj00i þ j11iÞ; 2

ð1Þ

1 j/ i ¼ pffiffiffi ðj00i  j11iÞ; 2

ð2Þ

1 jwþ i ¼ pffiffiffi ðj01i þ j10iÞ; 2

ð3Þ

1 jw i ¼ pffiffiffi ðj01i  j10iÞ; 2

ð4Þ

1 jUi ¼ pffiffiffi ðj000i þ j111iÞ; 2

ð5Þ

1 jWi ¼ pffiffiffi ðj001i þ j110iÞ: 2

ð6Þ

Suppose that three participants share two GHZ states jui123 and jui456 which are random in one of the states fjUi; jWig. And the particles 1 and 4, 2 and 5, 3 and 6 are held by three participants, respectively. If the participants measure their particles with the Bell basis, the possible relationships of their measurement results can be shown in Eqs. (7) and (8) (the cases, jWi  jWi and jWi  jUi, are omitted because the possible relationships shown in these cases are included in (7) and (8)).

1 1 jUi123  jUi456 ¼ pffiffiffi ðj000i þ j111iÞ123  pffiffiffi ðj000i þ j111iÞ456 2 2 ¼

1 ðj00i14 j00i25 j00i36 þ j01i14 j01i25 j01i36 2 þ j10i14 j10i25 j10i36 þ j11i14 j11i25 j11i36 Þ

1  ¼ pffiffiffi ðj/þ i þ j/ iÞ14 ðj/þ i þ j/ iÞ25 ðj/þ i þ j/ iÞ36 4 2  þ jwþ i þ jw iÞ14 ðjwþ i þ jw iÞ25 ðjwþ i þ jw iÞ36  þ jwþ i  jw iÞ14 ðjwþ i  jw iÞ25 ðjwþ i  jw iÞ36   þ j/þ i  j/ iÞ14 ðj/þ i  j/ iÞ25 ðj/þ i  j/ iÞ36 1 ¼ pffiffiffi ðj/þ i14 j/þ i25 j/þ i36 þ j/þ i14 j/ i25 j/ i36 2 2 þ j/ i14 j/þ i25 j/ i36 þ j/ i14 j/ i25 j/þ i36 þ jwþ i14 jwþ i25 jwþ i36 þ jwþ i14 jw i25 jw i36 þ jw i14 jwþ i25 jw i36 þ jw i14 jw i25 jwþ i36 Þ;

ð7Þ

1 1 jUi123  jWi456 ¼ pffiffiffi ðj000i þ j111iÞ123  pffiffiffi ðj001i þ j110iÞ456 2 2 1 ¼ ðj00i14 j00i25 j01i36 þ j01i14 j01i25 j00i36 2 þ j10i14 j10i25 j11i36 þ j11i14 j11i25 j10i36 Þ 1  ¼ pffiffiffi ðj/þ i þ j/ iÞ14 ðj/þ i þ j/ iÞ25 ðjwþ i þ jw iÞ36 4 2  þ jwþ i þ jw iÞ14 ðjwþ i þ jw iÞ25 ðj/þ i þ j/ iÞ36  þ jwþ i  jw iÞ14 ðjwþ i  jw iÞ25 ðj/þ i  j/ iÞ36   þ j/þ i  j/ iÞ14 ðj/þ i  j/ iÞ25 ðjwþ i  jw iÞ36 1 ¼ pffiffiffi ðj/þ i14 j/þ i25 jwþ i36 þ j/þ i14 j/ i25 jw i36 2 2 þ j/ i14 j/þ i25 jw i36 þ j/ i14 j/ i25 jwþ i36 þ jwþ i14 jwþ i25 j/þ i36 þ jwþ i14 jw i25 j/ i36 þ jw i14 jwþ i25 j/ i36 þ jw i14 jw i25 j/þ i36 Þ:

ð8Þ

We can see that the result obtained by measuring the particles 1 and 4 can be uniquely deduced by the remaining participants’ measurement results without any announcement. If we can make use of the property appropriately, we will build secure keys to achieve a secret sharing task. A special method is required to build the keys used in the secret sharing task. It makes neither agent has the ability to deduce solely any valuable information about the joint key, which is used by Trent to encrypt his secret message. We will show this method in the following details. Actually, the method can be generalized into the case of N-particle GHZ states. We use this character to achieve our multiparty secret sharing scheme in this paper. Because the determinate relationships only exist when measuring in the Bell basis, we need not take an alternative basis to build keys. Firstly, we give the detailed steps of our QSS scheme with the three-party case for simplicity. 1. Trent prepares 2n GHZ states fju1 iTAB ; ju2 iTAB ; . . . ; ju2n iTAB g randomly in the states fjUi; jWig, where the subscripts T; A; B denote three particles in every GHZ state, respectively. The sequences formed by three entangled particles of every GHZ state are denoted with ST ; SA and SB , respectively. 2. Trent prepares two sets of particles which are sufficient for statistical analysis of eavesdropping as the sample sets, which are denoted as DTA and DTB , respectively. Where the subscripts TAðTBÞ denotes the sample set used for checking the security when the sequence SA ðSB Þ is transmitted from Trent to Alice(Bob). Every particle in DTA [ DTB is prepared randomly with either Z-basis (i.e. fj0i; pffiffiffi pffiffiffi j1ig) or X-basis (i.e. fjþi ¼ ðj0i þ j1iÞ= 2; ji ¼ ðj0i  j1iÞ= 2g). Then Trent inserts DTA and DTB into SA and SB , respectively. Each particle in DTA ðDTB Þ is distributed in a random position of SA ðSB Þ. The new sequence is denoted with SdA ðSdB Þ, where the superscript d denotes the sequence with the sample set DTA ðDTB Þ. 3. Trent sends the sequences SdA and SdB to Alice and Bob, respectively, and retains the remaining sequence ST . 4. After being notified that Alice(Bob) has received the sequence   SdA SdB , Trent announces the positions of the particles belonging to DTA ðDTB Þ in the sequence SdA ðSdB Þ and the measurement basis. Alice(Bob) measures the sample particles in DTA ðDTB Þ according to Trent’s announcement and tells Trent her(his) measurement results. Trent compares the measurement results announced by the agents with the initial states of the particles in DTA and DTB , and analyzes the security of the transmissions. If either error rate is higher than the threshold determined by the channel noise, Trent cancels this protocol and restarts; or else they continue to the next step.

3649

Y. Sun et al. / Optics Communications 282 (2009) 3647–3651

5. Trent (Alice, Bob) measures every two particles in the sequence ST ðSA ; SB Þ (i.e. the ð2i  1Þth and the 2ith particles in the sequence, i ¼ 1; 2; . . . ; n) with the Bell basis. And then they transform their measurement result sequences to classical bit strings in accordance with the following encoding scheme.

j/þ i ) 00; j/ i ) 01;

jwþ i ) 10; jw i ) 11:

3.

ð9Þ

They denote these bit strings with K T ; K A and K B , respectively. 6. Let the bit string K T ¼ fðk1 ; l1 Þ; ðk2 ; l2 Þ; . . . ; ðkn ; ln Þg, where ðki ; li Þði ¼ 1; 2; . . . ; nÞ are the classical bits transformed by the ith Bell measurement result (i.e. the result obtained by measuring the ð2i  1Þth and the 2ith particles with the Bell basis). Trent can generate the joint key which is denoted with K 0T (let  0 0 0 0 0 0 K 0T ¼ fðk1 ; l1 Þ; ðk2 ; l2 Þ; . . . ; kn ; ln g) according to the following rules.

4.

If the ð2i  1Þth GHZ state and the 2ith one are different; (  0 0 and Trent’s ith Bell measurement result is j/ i; ki ; li ¼ ðki  1; li Þ: 0

0

and Trent’s ith Bell measurement result is jw i; ðki ; li Þ ¼ ðki ; li Þ:

5.

If the ð2i  1Þth GHZ state and the 2ith one are same 8   < and Trent’s ith Bell measurement result is j/ i; k0i ; l0i ¼ ðki ; li Þ: : and Trent’s ith Bell measurement result is jw i; k0 ; l0  ¼ ðk  1; l Þ: i i i i

K 0T ; K A and K B satisfy the relationship shown in Eq. (10).

K 0T

¼ KA  KB:

6.

ð10Þ

Therefore, K A and K B can be considered as Alice’s and Bob’s shared keys, respectively. Trent can adopt the one-time pad to encrypt his secret using the bit string K T and transmits the secret encrypted to Alice and Bob through the classical channels. Alice and Bob can rebuild Trent’s secret if and only if they cooperate because they own the shared keys, K A and K B , respectively. In the following, let us generalize our scheme into the N-party case. Suppose Trent wants to share his secret among N  1 agents, such as Alice1 ; Alice2 ; . . . and AliceN1 , our scheme in the N-party case can be described as follows. 1. Trent prepares 2n N-particle GHZ states fju1 iTA1 A2 AN1 ; ju2 iTA1 A2 AN1 ; . . . ; ju2n iTA1 A2 AN1 g in accordance with the following rule, where the subscripts T; A1 ; A2 ; . . . ; AN1 denote N entangled particles in every GHZ state, respectively. The ð2i  1Þth ði ¼ 1; . . . ; nÞN-particle GHZ states are prepared in the state

1 jU000 i ¼ pffiffiffi ðj00    0i þ j11    1iÞ: 2

ð11Þ

The 2ith ði ¼ 1; 2; . . . ; nÞN-particle GHZ states are prepared randomly in the states 1 jU00x1 x2 xN2 i ¼ pffiffiffi ðj00x1 x2    xN2 i þ j11ðx1  1Þðx2  1Þ    ðxN2  1ÞiÞ; 2 ð12Þ x1 ; x2 ; . . . ; xN2 2 f0; 1g:

The sequences formed by N entangled particles of every GHZ state are denoted with ST ; SA1 ; . . . ; SAN1 , respectively. 2. The sample sets which are prepared randomly in Z-basis or Xbasis, DTA1 ; DTA2 ; . . . ; DTAN1 , are used to detect eavesdropping when the sequences SA1 ; SA2 ; . . . ; SAN1 are transmitted from Trent to Alice1 ; Alice2 ; . . . and AliceN1 , respectively. Every sample set contains m particles which are sufficient for statistical analysis S of eavesdropping. Each particle in N1 i¼1 DTAi is random in one of fj0i; j1i; jþi; jig. Trent inserts DTA1 ; DTA2 ; . . . ; DTAN1 into SA1 ; SA2 ; . . . ; SAN1 , respectively. Each particle in the DTA1 ðDTA2 ; . . . ;

DTAN1 Þ is distributed in a random position of SA1 ðSA2 ; . . . ; SAN1 Þ. The new sequences are denoted with SdA1 ; SdA2 ; . . . ; SdAN1 , where the superscript d denotes the sequences with the sample sets DTA1 ; DTA2 ; . . . ; DTAN1 , respectively. Trent sends the sequences SdA1 ; SdA2 ; . . . ; SdAN1 to Alice1 ; Alice2 ; . . . and AliceN1 , respectively, and retains the remaining sequence ST . After being notified that Alice1 ðAlice2 ; . . . ; AliceN1 Þ has received the sequences SdA1 ðSdA2 ; . . . ; SdAN1 Þ, Trent announces the positions of the particles belonging to DTA1 ðDTA2 ; . . . ; DTAN1 Þ in the sequence SdA1 ðSdA2 ; . . . ; SdAN1 Þ and the measurement basis. Alice1 ðAlice2 ; . . . ; AliceN1 Þ measures the sample particles in DTA1 ðDTA2 ; . . . ; DTAN1 Þ according to Trent’s announcement and tells Trent the measurement results. Trent compares the measurement results announced by the agents with the initial states of the particles in DTA1 ; DTA2 ; . . . ; DTAN1 , and analyzes the security of the transmissions. If any error rate is higher than the threshold determined by the channel noise, Trent cancels this protocol and restarts; or else they continue to the next step. Trent ðAlice1 ; Alice2 ; . . . ; AliceN1 Þ measures every two particles in the sequence ST ðSA1 ; SA2 ; . . . ; SAN1 Þ (i.e. the ð2i  1Þth and the 2ith particles in the sequence, i ¼ 1; 2; . . . ; n) with the Bell basis. And then they transform their measurement result sequences to classical bit strings according to the encoding scheme shown in (9). They denote these bit strings with K T ; K A1 ; K A2 ; . . . ; K AN1 , respectively. K A1 ðK A2 ; . . . ; K AN1 Þ, which denotes the shared key owned by Alice1 ðAlice2 ; . . . ; AliceN1 Þ, will be used for rebuilding Trent’s secret. Let the bit string K T ¼ fðk1 ; l1 Þ; ðk2 ; l2 Þ; . . . ; ðkn ; ln Þg, where ðki ; li Þ ði ¼ 1; 2; . . . ; nÞ have the same definition in the threeparty case. Trent can generate the joint key which is denoted  0 0  0 0  0 0 with K 0T ¼ f k1 ; l1 ; k2 ; l2 ; . . . ; kn ; ln g according to the following rules. If N is even; 8 and in the 2ith GHZ state; the number of xj ðj ¼ 1; 2; . . . ; N  1Þ > >  0 0 > < whose value equals 1 is odd; ki ; li ¼ ðki  1; li Þ: > of xj ðj ¼ 1; 2; . . . ; N  1Þ > and in the 2ith GHZ state; the number >  0 0 : whose value equals 1 is even; ki ; li ¼ ðki ; li Þ: If N is odd; 8 and in the 2ith GHZ state; the number of xj ðj ¼ 1; 2; . . . ; N  1Þ > > > > > whose value equals 1 is odd > > (  0 0 > > > and Trent’s ith Bell measurement result is j/ i; ki ; li ¼ ðki  1; li Þ: > > >  0 0 > < and Trent’s ith Bell measurement result is jw i; k ; l ¼ ðki ; li Þ: i

i

> and in the 2ith GHZ state; the number of xj ðj ¼ 1; 2; . . . ; N  1Þ > > > > > whose value equals 1 is even > > (  0 0 > > > and Trent’s ith Bell measurement result is j/ i; ki ; li ¼ ðki ; li Þ: > > >  0 0 : and Trent’s ith Bell measurement result is jw i; ki ; li ¼ ðki  1; li Þ:

The joint key K 0T can be rebuilt if and only if Alice1 ; Alice2 ; . . . and AliceN1 cooperate as Eq. (13).

K 0T ¼ K A1  K A2      K AN1 :

ð13Þ

3. Security analysis Now, we begin to analyze the security for the present protocol. Suppose an eavesdropper, named Eve, wants to steal information about the joint key of the QSS protocol. Generally speaking, Eve is supposed to have unlimited computing power and technology, which is only limited by the laws of quantum mechanics. Meanwhile, we should notice that not all of the legitimate agents in the QSS protocol are credible. As mentioned in Ref. [22–24], a

3650

Y. Sun et al. / Optics Communications 282 (2009) 3647–3651

dishonest agent has more power than an outside eavesdropper because he knows partial information legally and can tell a lie in the stage of eavesdropping detection to try to avoid introducing errors. In other words, any eavesdropper, who wants to steal information during the QSS protocol, can be found out if the dishonest agents cannot eavesdrop without disturbing the quantum system. So the main goal for the security of our QSS protocol is simplified to prevent the dishonest agent or the unauthorized agent group from cheating. In the following text, we take the three-party case as an example and analyze the security of the scheme. We use Alice* to indicate the dishonest agent, Alice, in the protocol. Obviously, the security of our scheme is based on the security of the transmission of the sequence SB . According to Stingspring dila tion theorem [25], as Alice is limited to eavesdropping on the quantum line between Trent and Bob, her eavesdropping can be b E , on a larger Hilbert space, realized by a unitary operation, U HB  HE . We can describe the effect of Alice*’s eavesdropping on the particles of the sample sets in this scheme using the following equations:

b E j0ijei ¼ j0ije0 i þ j1ije1 i ; U E E E b E j1ijei ¼ j0ije0 i þ j1ije0 i ; U 0 E 1 E E

ð15Þ

  b E jþijei ¼ p1ffiffiffi j0ije0 i þ j1ije1 i þ j0ije0 i þ j1ije0 i U E E E 0 E 1 E 2 1 ¼ jþiðje0 iE þ je1 iE þ je00 iE þ je01 iE Þ 2  þjiðje0 iE  je1 iE þ je00 iE  je01 iE Þ ;

ð16Þ

ð14Þ

b E jijei ¼ p1ffiffiffi ðj0ije0 i þ j1ije1 i  j0ije0 i  j1ije0 i Þ U E E E 0 E 1 E 2 1 ¼ ½jþiðje0 iE þ je1 iE  je00 iE  je01 iE Þ þ jiðje0 iE 2  je1 iE  je00 iE þ je01 iE Þ;

ð17Þ

ð18Þ

For every particle of the sample sets, the action of Alice*’s eavesdropping will introduce an error rate

P0e ¼ he1 je1 i ¼ 1  he0 je0 i;

ð19Þ

P1e

ð20Þ

0 0 0j 0i

0 0 1 j 1 i;

¼ he e ¼ 1  he e 1 ¼ ð1 þ he0 je00 i þ he1 je01 i  he0 je01 i  he1 je00 iÞ; 2 1  Pe ¼ ð1  he0 je00 i  he1 je01 i  he0 je01 i  he1 je00 iÞ: 2

Pþe

ð21Þ ð22Þ



Moreover, Alice is supposed to be clever enough to prevent Trent and Bob from detecting her eavesdropping by finding the discrepancy in the error rates of quantum states. Then Eq. (23) follows.

he0 je0 i ¼ he01 je01 i; he1 je1 i ¼ he00 je00 i; he0 je00 i þ he1 je01 i ¼ 0:

ð23Þ



If Alice tries to achieve the eavesdropping without being detected,  the error rates P0e ; P 1e ; P þ e and P e have to equal 0 in the ideal environment which means that the quantum channels are noiseless. Then we can obtain Eq. (24) according to Eqs. (19)–(22).

he1 je1 i ¼ he00 je00 i ¼ 0; he0 je0 i ¼ he01 je01 i ¼ 1; he0 je01 i ¼ 1:

1 b E j0i jei þ j11i  U b E j1i jeiÞ ¼ pffiffiffi ðj00i12  U 3 12 3 2 1 b E j0i jei þ j11i  U b E j1i jeiÞ  pffiffiffi ðj00i45  U 6 45 6 2 1 ¼ ðj000i123 je0 i þ j111i123 je01 iÞðj000i456 je0 i þ j111i456 je01 iÞ 2 1 ¼ pffiffiffi ½ðj/þ i þ j/ iÞ14 ðj/þ i þ j/ iÞ25 ðj/þ i þ j/ iÞ36 je0 e0 i 4 2 þ ðj/þ i  j/ iÞ14 ðj/þ i  j/ iÞ25 ðj/þ i  j/ iÞ36 je01 e01 i þ ðjwþ i þ jw iÞ14 ðjwþ i þ jw iÞ25 ðjwþ i þ jw iÞ36 je0 e01 i þ ðjwþ i  jw iÞ14 ðjwþ i  jw iÞ25 ðjwþ i  jw iÞ36 je01 e0 i;

ð25Þ

b E jUi jeiÞ  ð U b E jWi jeiÞ ðU 123 456 1 b E j0i jei þ j11i  U b E j1i jeiÞ ¼ pffiffiffi ðj00i12  U 3 12 3 2 1 b E j1i jei þ j11i  U b E j0i jeiÞ  pffiffiffi ðj00i45  U 6 45 6 2 1 ¼ ðj000i123 je0 i þ j111i123 je01 iÞðj001i456 je01 i þ j110i456 je0 iÞ 2 1 ¼ pffiffiffi ½ðj/þ i þ j/ iÞ14 ðj/þ i þ j/ iÞ25 ðjwþ i þ jw iÞ36 je0 e01 i 4 2 þ ðj/þ i  j/ iÞ14 ðj/þ i  j/ iÞ25 ðjwþ i  jw iÞ36 je01 e0 i þ ðjwþ i  jw iÞ14 ðjwþ i  jw iÞ25 ðj/þ i  j/ iÞ36 je01 e01 i:

where jeiE is the initial state of Alice ’s ancilla and fje0 i; je1 i; je00 i; je01 ig are the pure ancilla’s states determined uniquely b E . Obviously, je0 i; je1 i; je0 i; je0 i must satby the unitary operation U 0 1 bEU b y ¼ I, i.e. isfy the relationship U E

he1 je0 i þ he01 je00 i ¼ 0; he0 je1 i þ he00 je01 i ¼ 0:

b E jUi jeiÞ  ð U b E jUi jeiÞ ðU 123 456

þ ðjwþ i þ jw iÞ14 ðjwþ i þ jw iÞ25 ðj/þ i þ j/ iÞ36 je0 e0 i



he0 je0 i þ he1 je1 i ¼ 1; he00 je00 i þ he01 je01 i ¼ 1

Therefore, in the three-party case of our QSS scheme, the quantum systems shown in Eqs. (7) and (8) should be rewritten with the effect of Alice*’s eavesdropping as follows, respectively. Suppose the third particle of each GHZ state will be sent to Bob.

ð24Þ

ð26Þ



From Eqs. (25) and (26), Alice can deduce that Trent’s measurement result is j/ iðjw iÞ if her measurement result is j/ iðjw iÞ. In other words, Alice* has the ability to distinguish Trent’s measurement result between j/ i and jw i. Since the joint key K 0T is generated according to not only the formula (9) but also the rule stated in the step 6, Trent’s measurement result j/ iðjw iÞ in Eqs. (25) and (26) will be converted into different bit pair, respectively. As shown  in Eqs. (25) and (26), when Alice ’s measurement result is   j/ iðjw iÞ, she is able to determine that the bit pair of the joint key in this position, which is corresponding to Trent’s measurement result, is f00; 01g or f10; 11g on the condition that she can distinguish between fje0 e0 i; je01 e01 ig and fje0 e01 i; je01 e0 ig. In other words, if the elements coming from fje0 e0 i; je01 e01 ig and fje0 e01 i; je01 e0 ig, respectively, are mutually orthogonal, Alice can obtain a half of information about the joint key without being detected. Fortunately, according to Eq. (24), we will conclude the following equations and deduce that the elements in fje0 e0 i; je01 e01 i; je0 e01 i; je01 e0 ig are pairwise non-orthogonal.

he0 e0 je0 e01 i ¼ he0 je0 ihe0 je01 i ¼ 1; he0 e0 je01 e0 i ¼ he0 je01 ihe0 je0 i ¼ 1; he01 e01 je0 e01 i ¼ he01 je0 ihe01 je01 i ¼ 1; 0 0 0 1 1j 1 0i

he

ð27Þ

0 0 0 1 j 1 ih 1 j 0 i

e e e ¼ he e e e ¼ 1: 

So Alice is impossible to distinguish any bit pair in K 0T between f00; 01g and f10; 11g and won’t obtain any information about the joint key without introducing errors in the detection process. In other words, Alice* will introduce errors invariably if she wants to steal valuable information about Trent’s secret without Bob, who is honest in the scheme.

Y. Sun et al. / Optics Communications 282 (2009) 3647–3651

We should point out that, in essence, the quantum systems shown in Eqs. (25) and (26) can be rewritten as a direct product of Alice*’s ancilla and the quantum systems shown in Eqs. (7) and (8) because of the equality relationship je0 i ¼ je01 i derived from  Eq. (24). It implies that Alice ’s eavesdropping will have no effect on the whole system used to construct keys if she wants to eavesdrop without being detected. That is to say, we can detect all  Alice ’s attacks including the disturbance attack, which makes the scheme to be”Denied-Of-Service”. So it suffices to conclude  that our scheme is secure for Alice ’s eavesdropping under an ideal environment. In addition, if the quantum channels are noisy, the security of our scheme can be guaranteed by performing quantum error correction and privacy amplification.

4. Conclusion To summarize, we present a multiparty QSS scheme using entanglement swapping theory. It has some good properties, which make it different from the previous protocols. 1. When building the joint key and shared keys, all agents need do nothing but measure the quantum states in hand with the Bell basis no matter how many participants there are. (During the detection processes, single-particle measurements are required to be performed by all participants. In fact, their realizations are included in the Bell measurement.) 2. The agents are not required to prepare any M-particle entangled states ðM P 2Þ. It is an outstanding merit especially in the Nparty case ðn > 3Þ since the generation of N-particle entangled states is more difficult than the Bell measurement. 3. No classical information needs to be announced when the participants found the joint key. So the total efficiency of our scheme approaches 100%. Just like all existing QSS protocols, the present one also has weakness inevitably. Because the entangled states must be shared among all participants securely, the quantum storage technology is requisite for eavesdropping detection.

3651

Acknowledgements This work is supported by National Natural Science Foundation of China (Grant Nos. 60873191 and 60821001), Specialized Research Fund for the Doctoral Program of Higher Education (Grant No. 200800131016), Beijing Natural Science Foundation (Grant No. 4072020), National Laboratory for Modern Communications Science Foundation of China (Grant No. 9140C1101010601), and ISN Open foundation. References [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27]

M. Hillery, V. Buzˇek, A. Berthiaume, Phys. Rev. A 59 (1999) 1829. A. Karlsson, M. Koashi, N. Imoto, Phys. Rev. A 59 (1999) 162. W. Tittel, H. Zbinden, N. Gisin, Phys. Rev. A 63 (2001) 042301. S. Bagherinezhad, V. Karimipour, Phys. Rev. A 67 (2003) 044302. L.Y. Hsu, Phys. Rev. A 68 (2003) 022306. L. Xiao, G.L. Long, F.G. Deng, J.W. Pan, Phys. Rev. A 69 (2004) 052307. S.K. Singh, R. Srikanth, Phys. Rev. A 71 (2005) 012328. Z.J. Zhang, Y. Li, Z.X. Man, Phys. Rev. A 71 (2005) 044301. C. Schmid, P. Trojek, M. Bourennane, C. Kurtsiefer, M. Zukowski, H. Weinfurter, Phys. Rev. Lett. 95 (2005) 230505. F.L. Yan, T. Gao, Phys. Rev. A 72 (2005) 012304. Z.J. Zhang, Z.X. Man, Phys. Rev. A 72 (2005) 022303. F.G. Deng, X.H. Li, H.Y. Zhou, Phys. Lett. A 372 (2008) 1957. G. Gordon, G. Rigolin, Phys. Rev. A 73 (2006) 062316. H. Takesue, K. Inoue, Phys. Rev. A 74 (2006) 012304. M. Zukowski, A. Zeilinger, M.A. Horne, A.K. Ekert, Phys. Rev. Lett. 71 (1993) 4287. A. Cabello, e-print quant-ph/0009025. J. Lee, S. Lee, J. Kim, S.D. Oh, Phys. Rev. A 70 (2004) 032305. Z.Y. Xue, Y.M. Yi, Z.L. Cao, Chinese Phys. 15 (2006) 1421. F.G. Deng, X.H. Li, C.Y. Li, P. Zhou, H.Y. Zhou, Eur. Phys. J. D 39 (2006) 459. Z.X. Man, Y.J. Xi, N.B. An, Eur. Phys. J. D 42 (2007) 333. Z.J. Zhang, Y.M. Liu, M. Fang, D. Wang, Int. J. Mod. Phys. C 18 (2007) 1885. F.G. Deng, X.H. Li, H.Y. Zhou, Z.J. Zhang, Phys. Rev. A 72 (2005) 044302. S.J. Qin, F. Gao, Q.Y. Wen, F.C. Zhu, Phys. Lett. A 357 (2006) 101. F. Gao, S.J. Qin, Q.Y. Wen, F.C. Zhu, Quantum Inf. Comput. 7 (2007) 329. W.F. Stinespring, P. Am. Math. Soc. 6 (1955) 211. C. Schuck, G. Huber, C. Kurtsiefer, H. Weinfurter, Phys. Rev. Lett. 96 (2006) 190501. M. Barbieri, G. Vallone, P. Mataloni, F. De Martini, Phys. Rev. A 75 (2007) 042317.